CALIFORNIAHackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)LowContained

San Francisco Department of Public Health

bd_55d794beb502891b · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 27, 2017

Filed

Jun 25, 2018

To disclose

26 weeks

Affected

900

Linked

2 filings

Confidence

65%

Full breach record for San Francisco Department of Public Health →3 incidents on file

San Francisco Department of Public Health reported to HHS on 2018-06-25 a Unauthorized Access/Disclosure affecting 900 individuals. Breached information located on Network Server. An individual gained unauthorized access to a business associate's network server and downloaded PHI (names, DOB, diagnoses) to an external hard drive. Notification was provided on May 11, 2018, following a law enforcement delay.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Dec 27, 2017 → Notified May 11, 2018135d ✗ HIPAA individual notice late26 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 26 weeks / 180 days

Dec 27, 2017

Begins

Dec 27, 2017

Discovered

Jun 25, 2018

Filed

vs. sector median

+15 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_5d4e4a5c52a98a022018-05-11 · +45dCandidate

Name: San Francisco Department of Public Health
norm: san francisco department of public health
Industry: Health Care Services

Name: San Francisco Department of Public Health
norm: san francisco department of public health
Industry: Healthcaresource default

Discovered: Dec 27, 2017
Breach occurred: Dec 27, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2018
Affected individuals: 900nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Business Associate (unnamed)business associate
Initial access: valid_credentials

During the incident: Blocked the unauthorized access
Cooperated with law enforcement
Implemented additional technical and physical safeguards
Changes made: Implemented additional technical and physical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(180 days from discovery to filing)
Compliance flags: HIPAA individual notice late · 135dHHS report late · 135dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 27, 2017
→ Notified: May 11, 2018
135d 60 days HIPAA individual notice late
HIPAA
Discovered: Dec 27, 2017
→ Notified: May 11, 2018
135d 60 days HHS report late
HIPAA
Discovered: Dec 27, 2017
→ Notified: May 11, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 27, 2017 → Notified: May 11, 2018	135d	60 days	HIPAA individual notice late
HIPAA	Discovered: Dec 27, 2017 → Notified: May 11, 2018	135d	60 days	HHS report late
HIPAA	Discovered: Dec 27, 2017 → Notified: May 11, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGMay 11 · first

HHS OCR+45d · this page

Pattern: first filing May 11 (CA), last Jun 25 (CA) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 25, 2018
Raw hash: cdb1c43a8b0a873d099610a1cb921454b43a9822eda22843266189d11fa757f9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySan Francisco Department of Public Health

Victim entitySan Francisco Department of Public Health

Incidentdiscovered Dec 27, 2017

Stated responseBlocked the unauthorized access

ComplianceHIPAA individual notice late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing